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Amendments to the Specification 

Please amend paragraph [0093] on page 14 to read as follows: 

[0093] One key approach to detecting problems involves using the history of the monitored data. 
A particularly simple way of doing this is illustrated by the time over threshold rule, the 
operation of which can be more easily understood by referring to FIG. 5. In general, as 
LiveExceptions accumulates polled data 41 for a particular varabl e variable, LE engine 100 
looks at that data over an interval of time, referred to as an analysis window 42, which in the 
described embodiment is typically an hour though it could be longer or shorter depending upon 
the circumstances and performance needs. LE engine 100 compares the data values in this 
interval with a predefined threshold 40, and computes the total time that the value is over the 
threshold. In the illustrated example, the accumulated time is the sum of intervals 44, 45, 46 and 
47. If this total time is greater than a predefined amount, referred to as a condition window, LE 
engine 100 raises an alarm and sends out a trap to the NMS. 

Please amend paragraph [0129] on page 19 to read as follows: 

[0129] FIG. 6 illustrates graphically how the dynamic time over threshold rule works. The 
dynamic time over threshold algorithm includes a normal value 51, i.e. a dynamic threshold 
value, an analysis window 52 and a condition window 53 (a pr e d e fin e d fix e d valu e , not shown) . 
Normal value 50 is the value a data series cannot deviate by more than a certain amount, analysis 
window 52 is a sliding interval of time, and the condition window is a time threshold for the 
accumulated time during which the variable exceeds the mean by the predetermined amount (e.g. 
the sum of time intervals 54, 55, 56 and 57). The alarm generation process is similar to that used 
for the time over threshold rule illustrated in FIG. 5. One major difference between this rule and 
the time over threshold rule is that threshold 40 is replaced by a time-varying normal value plus a 
"deviation." 
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Please amend paragraph [0185] on page 27 to read as follows: 

[0185] Referring to FIG. 7H Gr-6, an exception event viewer 130 displays an exception event 
chart 61, an exception event table 62 and an organization frame 63 for communicating 
information to the network manager. Through exception chart 61, the system shows the total 
number of active exceptions for all elements in a selected group, or by default displays all the 
elements exception count. Through exception event table 62, the system lists all current 
exceptions. And through organization frame 63, the system allows a user to view all group lists, 
groups and elements and give an overall summary data view. Each of the display components 
can be easily resized, collapsed or expanded so that a user can focus on a particular display 
component. 

Please amend paragraph [0198] on page 29 to read as follows: 

[0198] An example of an alarm detail report 70 for a particular variable is shown in FIG. SFiGr 

Report 70 plots the value of the relevant variable as a function of time (see plot 73). It also 
displays a sequence of vertical bars 72, each one representing a different 1-hour period of time 
and each one having a center line 71 marking the mean value of that variable for that time of day 
over a preceding period of time. The extent of each bar characterizes the observed variation of 
that variable from its mean over that preceding period of time. In this case, it represents plus and 
minus one standard deviation from the observed mean value. 



